These are hosted on a New Wave Netconnect IP at 23.95.106.223. This forms part of a block 23.95.106.128/25 which also contained Locky download locations at two other locations [1][2] which rather makes me think that the whole range should be blocked.

A DLL is dropped with a detection rate of about 8/57[3][4] which appears to phone home to: